Consume service from secured CAP application in external UI5 application

[mikolaj_k]

Hello,

I have exposed a nodejs service in my CAP application and now I need access in external ui5 app (not included in mta of CAP app). The service restricted with 'authenticated-user' is working well, but when the service is restricted with a role I have no access and still 403 error. I am using client_id and client_secret from xsuaa instance of CAP app.

The roles are assigned in BTP.

How can I get access to the secured service?

Thanks in advance for your help.

screens from service.cds file

'authenticated-user' - READ works good

role restricted - need help

[junwu]

are they using same xsuaa instance? how does your xs-security look like?

[mikolaj_k]

to be honest I do not really know how to use the same xsuaa instance. Should I configure it just in mta file? I tried to use the xsuaa from CAP as an existing-service and did not work (maybe config was not ok)

xs-security from UI5 app:

{ "xsappname": "riskfiori", "tenant-mode": "dedicated", "description": "Security profile of called application", "authorities":["$ACCEPT_GRANTED_AUTHORITIES"], "foreign-scope-references": [ "$XSAPPNAME(application,risk-management).RiskViewer" ], "authorities-inheritance": true, "scopes": [ { "name": "uaa.user", "description": "UAA" } ], "role-templates": [ { "name": "Token_Exchange", "description": "UAA", "scope-references": [ "uaa.user" ] } ]}

my xs-security from CAP app (tried to grant authorities but did not work) and xsappname is set in mta file - risk-management:

{ "scopes": [ { "name": "$XSAPPNAME.RiskViewer", "description": "RiskViewer", "granted-apps" : [ "$XSAPPNAME(application,riskfiori)"], "grant-as-authority-to-apps" : [ "$XSAPPNAME(application, riskfiori)"] }, { "name": "$XSAPPNAME.RiskManager", "description": "RiskManager" } ], "attributes": [], "role-templates": [ { "name": "RiskViewer", "description": "generated", "scope-references": [ "$XSAPPNAME.RiskViewer" ], "attribute-references": [] }, { "name": "RiskManager", "description": "generated", "scope-references": [ "$XSAPPNAME.RiskManager" ], "attribute-references": [] } ], "oauth2-configuration": { "credential-types": [ "binding-secret", "x509" ], "redirect-uris": [ "https://*.applicationstudio.cloud.sap/**", "https://*.cfapps.us10.hana.ondemand.com/**" ] }}

[gregorw]

Are you in the same project as divyeaggarwal? He posted the question: How to access XSUAA enabled CAP Service destination in standalone SAP UI5 Application

[mikolaj_k]

Hi gregorw,

No, I'm not in the same project

[mikolaj_k]

It looks there is a problem with destination. Can you check if the token URL and credentials are set up correctly?

[Former Member]

I saw your posted answer. I recommend raising your question again as a new question and follow our rules of engagement: https://community.sap.com/resources/rules-of-engagement. Feel free to take our Q&A tutorial at: https://developers.sap.com/tutorials/community-qa.html. With these tips you'll be able to prepare questions that draw responses from our members.

Thanks!

[gregorw · Accepted solution]

I would suggest that you use a destination with Authentication OAuth2UserTokenExchange. That way you can keep your XSUAA instances separate but let a user who has the correct roles assigned for your CAP backend being able to use it.

[mikolaj_k · Accepted solution]

Ohh it really works! Thanks!

[mikolaj_k · Accepted solution]

gregorw is it possible to access secured with roles service through postman?

[gregorw · Accepted solution]

Do you want to test with a technical user or with a user from Identity Authentication / SAP ID Service?

[mikolaj_k · Accepted solution]

Hi gregorw can you tell me how to test it with a technical user?

[mikolaj_k · Accepted solution]

gregor.wolf can you help me? How can I test it with a technical user?